Threats Affecting Croatia

A sophisticated Android malware campaign has been identified conducting carrier billing fraud through premium SMS abuse across Malaysia, Thailand, Romania, and Croatia. The operation comprises nearly 250 malicious applications that selectively target users based on their mobile operators, silently subscribing victims to premium services without consent. The malware demonstrates advanced capabilities including precise regional targeting with hardcoded SIM operator validation, automated subscription workflows using WebView manipulation and JavaScript injection, OTP interception via abuse of Google's SMS Retriever API, and Telegram-based exfiltration of device metadata. The campaign impersonates popular applications including Facebook, Instagram, TikTok, Minecraft, and Grand Theft Auto to lure victims. Active from March 2025 through January 2026, the operation employs three distinct variants with increasing levels of sophistication, utilizing distributed command and control infrastructure and systematic refer...

MediumCampaignMalaysiaThailandRomania+1#android#telegram exfiltration#otp interception

UAT-7290, a sophisticated threat actor active since 2022, is targeting critical infrastructure entities in South Asia, particularly telecommunications providers. The group's arsenal includes malware families like RushDrop, DriveSwitch, SilentRaid, and Bulbature. UAT-7290 conducts extensive reconnaissance before intrusions, using one-day exploits and SSH brute force to compromise edge devices. The actor is believed to be a China-nexus APT, sharing similarities with APT10 and other known Chinese threat groups. UAT-7290 has recently expanded its targeting to Southeastern Europe and may establish Operational Relay Boxes for other China-nexus actors. Their malware suite primarily focuses on Linux systems but can also utilize Windows-based implants.

MediumMalwareGreeceBulgariaRomania+4#driveswitch#china-nexus#espionage

NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through unsanitized input to potentially disclose sensitive information from the mobile banking application.

HighVulnerabilityNorth MacedoniaSloveniaCroatia+4#cve#cve-2023-54163

Gunra Ransomware is a double extortion group targeting global victims, excluding the US. They primarily attack Windows systems, recently expanding to Linux. The group uses phishing as their main vector and negotiates through a WhatsApp-themed chat panel. They can encrypt large files quickly using advanced stream ciphers. The Data Leak Site has undergone several changes, including a brief clearweb presence. Victims span multiple countries and industries, with South Korea, Brazil, and Japan topping the list. The ransomware shares code similarities with Conti and Akira, but newer versions appear unique. Negotiations reveal ambitious ransom demands, sometimes unrealistic. The group employs various evasion techniques and uses multiple MITRE ATT&CK tactics.

MediumMalwareCroatiaItalySouth Korea+8#windows#lumma stealer#encryption

Tourism Management System 2.0 - Arbitrary Shell Upload

MediumVulnerabilityGermanyFranceItaly+6#web#exploit

A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/add-boat.php. The manipulation of the argument boatname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

MediumVulnerabilityUnited KingdomGermanyFrance+5#cve#cve-2025-8431

A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/confirm_reserve.php. The manipulation of the argument transaction_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

MediumVulnerabilitySpainItalyFrance+4#cve#cve-2025-6450